provider: gke controlplaneAWSProviderConfig: provider-aws # used to provision global resources such as route53 recordset and pca certificate controlplaneGCPProviderConfig: provider-gcp clusterController: configChange: accountEnv: prod activity: enabled: false activityHubEndpoint: "https://e4hr1v4oqh.execute-api.us-west-2.amazonaws.com" activityHubSource: "gitops" clinicEndpoint: "https://clinic.pingcap.com" clusterAgent: chartPath: /etc/helm/cluster-agent agentImage: repo: gcr.io/dbaas-prod/tidbcloud/cluster-agent tag: v0.1.9 mysqlProtocolProbe: image: "gcr.io/dbaas-prod/tidbcloud/mysql-readiness-probe:v0.1.0" binaryName: "mysql-readiness-probe" timeoutSeconds: 5 # Will have a maximum of 150 minutes (900 * 10 = 9000s = 150m) to finish its startup periodSeconds: 10 failureThreshold: 900 audit: sidecarImage: gcr.io/pingcap-public/audit:81dc098e2ad54c6918e7c5aac80b052f532bc39f sidecarCommand: ["/audit", "server", "--config", "/etc/audit/audit.yaml"] network: k8sVersion: "1.34" gkeMaintenanceExclusionTimeWindow: startTime: "2025-03-12T00:00:00Z" endTime: "2025-04-11T00:00:00Z" certmanager: chartPath: /etc/helm/certmanager/cert-manager-v1.10.0.tgz crdPaths: [/etc/helm/certmanager/cert-manager-crds-v1.10.0.yaml] controllerImage: repo: quay.io/jetstack/cert-manager-controller tag: v1.10.0 webhookImage: repo: quay.io/jetstack/cert-manager-webhook tag: v1.10.0 cainjectorImage: repo: quay.io/jetstack/cert-manager-cainjector tag: v1.10.0 clusterAutoscaler: chartPath: /etc/helm/aws-cluster-auto-scaler/ image: repo: 385595570414.dkr.ecr.us-west-2.amazonaws.com/tidbcloud/cluster-autoscaler tag: v1.25.0 operator: advancedStatefulset: name: gcr.io/pingcap-public/dbaas/advanced-statefulset:v0.8.0 chartPath: /etc/helm/tidb-operator/tidb-operator-v1.7.0-alpha.4 crdPaths: - /etc/helm/tidb-operator/advanced-statefulset-crd.v1.yaml - /etc/helm/tidb-operator/tidb-operator-v1.7.0-alpha.4.yaml operator: name: gcr.io/pingcap-public/dbaas/tidb-operator tag: v1.7.0-alpha.4 tidbBackupManager: name: gcr.io/pingcap-public/dbaas/tidb-backup-manager tag: v1.7.0-alpha.4 dbMonitorProm: name: gcr.io/pingcap-public/dbaas/prometheus tag: v2.11.1 dbMonitorGrafana: name: gcr.io/pingcap-public/dbaas/grafana tag: 6.0.1 proxy: chartPath: /etc/helm/proxy/cluster-proxy proxyImage: repo: gcr.io/dbaas-prod/dbaas/prod/cluster-proxy tag: v1.2.56 gottyImage: repo: gcr.io/pingcap-public/dbaas/gotty tag: "20211103" allowedCidrs: - "54.188.27.23/32" # global controlplane (base cluster) NAT IP - "44.231.162.131/32" # global controlplane (base cluster) NAT IP - "100.20.198.224/32" # global controlplane (base cluster) NAT IP - "35.197.97.193/32" # regional controlplane (seed cluster) NAT IP - "34.82.228.7/32" # regional controlplane (seed cluster) NAT IP - "52.41.43.61/32" # for clinic vpc auth0Audience: "prod-proxy-service" auth0Domain: "tidb.auth0.com" clusterGateway: chartPath: /etc/helm/kong crdPaths: - /etc/helm/kong/crds/custom-resource-definitions.yaml - /etc/helm/kong/crds/gateway-api-crd-standard-install.yaml kongImage: repo: gcr.io/pingcap-public/third-party/kong/kong tag: "3.6" kongIngressControllerImage: repo: gcr.io/pingcap-public/third-party/kong/kubernetes-ingress-controller tag: "3.1" allowedCidrs: - "54.188.27.23/32" # global controlplane (base cluster) NAT IP - "44.231.162.131/32" # global controlplane (base cluster) NAT IP - "100.20.198.224/32" # global controlplane (base cluster) NAT IP - "35.197.97.193/32" # regional controlplane (seed cluster) NAT IP - "34.82.228.7/32" # regional controlplane (seed cluster) NAT IP - "52.41.43.61/32" # for clinic vpc - "35.82.108.84/32" # devops-server dataflowAgent: chartPath: /etc/helm/dataflow-agent/dataflow-agent.tgz dataflowAgentImage: repo: gcr.io/dbaas-prod/dbaas/prod/dataflow-agent tag: release-v20260804 allowedCidrs: - "54.188.27.23/32" # global controlplane (base cluster) NAT IP - "44.231.162.131/32" # global controlplane (base cluster) NAT IP - "100.20.198.224/32" # global controlplane (base cluster) NAT IP - "35.197.97.193/32" # regional controlplane (seed cluster) NAT IP - "34.82.228.7/32" # regional controlplane (seed cluster) NAT IP tiflowOperator: chartPath: /etc/helm/tiflow-operator/tiflow-operator.tgz crdPaths: - /etc/helm/tiflow-operator/tiflow-operator/crds/pingcap.com_tiflowclusters.yaml tiflowOperatorImage: repo: gcr.io/pingcap-public/tidbcloud/tiflow-operator tag: 9ab11c525e3693cc92199e344f0f394233800821 enable: true pcaIssuer: chartPath: /etc/helm/pca-issuer/aws-privateca-issuer-1.2.0-fixed.tgz crdPaths: - /etc/helm/pca-issuer/aws-pca-issuer-crd.yaml - /etc/helm/pca-issuer/aws-pca-clusterissuer-crd.yaml image: # TODO(tennix): this used a fork version of aws-pca-issuer https://github.com/tidbcloud/aws-pca-issuer # We need to update to the upstream version repo: gcr.io/pingcap-public/dbaas/aws-pca-issuer # we should use v1.2.2 tag: v1.2.2 sliReporter: chartPath: /etc/helm/sli-reporter/sli-reporter.tgz image: repo: gcr.io/dbaas-prod/dbaas/prod/sli-reporter tag: v2.3.2 awsRegion: us-west-2 deliveryStreamName: "sli-prod-metrics" deliveryStreamRoleArn: "arn:aws:iam::557537366020:role/sli-cross-account-role" region: us-west1 zones: - us-west1-a - us-west1-b - us-west1-c apiserverPublicAccessCidrs: - "54.185.150.209/32" # bastion NAT IP - "54.188.27.23/32" # global controlplane (base cluster) NAT IP - "44.231.162.131/32" # global controlplane (base cluster) NAT IP - "100.20.198.224/32" # global controlplane (base cluster) NAT IP - "35.197.97.193/32" # regional controlplane (seed cluster) NAT IP - "34.82.228.7/32" # regional controlplane (seed cluster) NAT IP - "35.227.188.59/32" # o11y regional service - "35.82.108.84/32" # devops cluster o11yConfig: env: prod seedVectorURL: "http://seed-us-west-2-vector-aggregator.prod.shared.aws.tidbcloud.com:9090" seedVectorEpSvcName: com.amazonaws.vpce.us-west-2.vpce-svc-001d51b454af1437b infraTenantID: infra-prod openAPIAddress: https://www.gs.us-west-2.aws.observability.tidbcloud.com createO11yInfraPath: /api/v1/clusters deleteO11yInfraPath: /api/v1/clusters getO11yInfraPath: /api/v1/clusters pauseO11yInfraPath: /api/v1/clusters resumeO11yInfraPath: /api/v1/clusters auth0GetTokenURL: https://tidb-soc2.us.auth0.com/oauth/token auth0Audience: https://tidb-soc2.us.auth0.com/api/v2/ effectiveRegion: - aws-us-west-2-* - aws-eu-central-1-* - aws-ap-south-1-* - aws-ap-southeast-1-* - aws-ap-northeast-1-* - aws-ap-northeast-2-* - aws-us-east-1-* - gcp-us-west1-* - gcp-asia-east1-* - gcp-us-central1-* - gcp-asia-northeast1-* - gcp-asia-southeast1-* - gcp-asia-northeast2-* lokiServerDns: a5bb1e2a8625f4a28b44ff9ee740ec3a-1136545906.us-west-2.elb.amazonaws.com version: 20221126 eventExporter: image: repo: gcr.io/pingcap-public/third-party/resmoio/kubernetes-event-exporter tag: v1.0 chartPath: /etc/helm/event-exporter/event-exporter.tgz metricsAgent: image: repo: victoriametrics/vmagent tag: v1.78.0 chartPath: /etc/helm/vmagent/victoria_metrics_agent.tgz clusterAgent: image: repo: gcr.io/pingcap-public/dbaas/vector tag: 0.23.X-2-debian logAgent: image: repo: gcr.io/pingcap-public/dbaas/vector tag: 0.23.X-2-debian chartPath: /etc/helm/vector/vector.tgz loki: image: repo: gcr.io/pingcap-public/fluent-bit-plugin-loki tag: main-8c1095a55-1.8.15-final-multi-arch chartPath: /etc/helm/fluent-bit so11y: image: repo: prom/prometheus tag: v2.38.0 chartPath: /etc/helm/prometheus/prometheus.tgz kubeStateMetrics: chartPath: /etc/helm/kube-state-metrics/kube-state-metrics.tgz image: registry: registry.k8s.io repo: kube-state-metrics/kube-state-metrics tag: v2.10.0 nodeExporter: chartPath: /etc/helm/node-exporter/node-exporter.tgz image: registry: quay.io repo: prometheus/node-exporter tag: v1.6.1 audit: sidecarImage: gcr.io/pingcap-public/audit:81dc098e2ad54c6918e7c5aac80b052f532bc39f sidecarCommand: ["/audit", "server", "--config", "/etc/audit/audit.yaml"] # sentry: # dsn: https://e85c9a30f8b54ae39ecf4a7b63dea760@o226447.ingest.sentry.io/6688512 # env: prod mixedDeployPDWithTiKV: enabled: false affectClusterCreatedAfter: "2022-11-03T00:00:00Z" affectNamespaceAllowList: [] tiflowCluster: master: defaultSpecCode: master-share-2c2g expirationMinute: 120 shareDb: enableProxy: true proxyImage: "gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.1.0" serviceName: "dbaas-prod:us-west1:tiflow-prod-us-west1-5baeb43" port: 3306 user: dataflow password: imageConfig: repo: gcr.io/pingcap-public/tidbcloud/tiflow tag: de06be9be58e3f78564b4b37f94ee72206300762 executor: imageConfig: repo: gcr.io/pingcap-public/tidbcloud/tiflow tag: de06be9be58e3f78564b4b37f94ee72206300762 configServiceEndpoint: http://adffa969f7149406b84145c461c3670a-344077277.us-west-2.elb.amazonaws.com:8090 storageClassConfigFile: /etc/cluster-controller/storageclass/storageclass-config.yaml instanceTypeConfigFile: /etc/cluster-controller/instancetype/instancetype-config.yaml predicate: matchLabels: cloud.pingcap.com/provider-type: gke cloud.pingcap.com/region: us-west1 matchExpressions: - key: "cloud.pingcap.com/reconciler" operator: "DoesNotExist" fullManage: project: prod publicHostedZoneDomain: clusters.tidb-cloud.com publicHostedZoneID: Z09521541042LFILW1KL4 serviceRoleARN: "arn:aws:iam::380838443567:role/full-manager-eks-role" serviceRoleName: "full-manager-eks-role" assumeRoleARN: "arn:aws:iam::380838443567:role/full-manager-service-role" componentPCAARN: arn:aws:acm-pca:us-west-2:380838443567:certificate-authority/ed5106d3-0890-4af9-bd60-b6df4f6299ca assumeRoleExternalID: "123" gcpProjectID: dbaas-prod gcpClusterServerSAName: "prod-cluster-server" featureGates: network_hibernation: all: true tidb_add_index: all: true tidb_expose_oom_path_for_new_cluster: all: true tidb_expose_oom_path_for_existing_cluster: all: false tidb_expose_replayer_path_for_new_cluster: all: true tidb_expose_replayer_path_for_existing_cluster: all: false tidb_enable_audit_log: all: true o11y_deploy_crd: all: true o11y_deploy_crd_tiflow: all: true tls_cluster: all: true tidb_enable_bootstrap_sql: all: true disable_nodepool_data_plane_label: all: false tidb_monitor_disabled: all: true disable_gke_logging: all: true disable_gke_monitoring: all: true independent_config_change: all: false enabledTenants: - 1372813089187791289 # dbaastest3 scale_out_tidb_in_parallel: all: true enable_cluster_agent: all: true cluster_gateway: all: true enable_dp_compatibility_mode: all: true set_priority_class: all: true mysqlProtocolProbe: image: "gcr.io/dbaas-prod/tidbcloud/mysql-readiness-probe:v0.1.0" binaryName: "mysql-readiness-probe" timeoutSeconds: 5 # Will have a maximum of 150 minutes (900 * 10 = 9000s = 150m) to finish its startup periodSeconds: 10 failureThreshold: 900 expFeatureGates: - name: "AnalyzeVersion2" minSupportVersion: "v6.5.0" command: "SET GLOBAL tidb_analyze_version=2;" featureGate: all: true enabledProjects: [] enabledTenants: [] disabledProjects: [] disabledTenants: [] - name: "RuntimeFilterMode" minSupportVersion: "v7.3.0" command: "SET GLOBAL tidb_runtime_filter_mode=LOCAL;" featureGate: all: true enabledProjects: [] enabledTenants: [] disabledProjects: [] disabledTenants: [] maxConcurrentReconciles: network: 5 cluster: 10 networkPeer: 5 clusterNodeProtector: 5 eksConnection: 5 frpServer: 5 privateLink: 5 privateLinkEndpoint: 5 hibernation: enabled: true configChangeConfig: accountEnv: prod activity: enabled: false activityHubEndpoint: "https://e4hr1v4oqh.execute-api.us-west-2.amazonaws.com" activityHubSource: "gitops" clinicEndpoint: "https://clinic.pingcap.com" dpCompatEnv: prod